Coil — Privacy Policy

Version 1.0 — effective 2026-08-23

This policy explains what personal data Coil collects, why, where it is kept, and what you can ask us to do with it. It is written to be read, not to be survived.

1. Who is responsible

Coil is operated by an individual proprietor in India. Contact details, including the grievance contact required under India's Digital Personal Data Protection Act, 2023, are on the Contact page.

2. What we collect

When you create an account

Your email address.
A hash of your password (scrypt). We never store, and cannot recover, your actual password.
The date you accepted the disclaimer and terms, and which version you accepted.

When you use Coil

Your watchlist: the symbols you star.
Settings you choose, such as chart preferences and saved layout.
If you use the risk calculator, the account size and trade figures you type. These are your numbers; we store them so the calculator remembers them between visits, and they are never combined with anything else or shared.

Automatically

A session cookie that keeps you logged in. It is HttpOnly and SameSite=Lax.
Ordinary web-server logs: IP address, timestamp, requested URL, user agent. These exist to run and secure the service.

When you subscribe

Your subscription and payment records: plan, status, renewal date, amount, and Razorpay's payment identifiers.

We never see your card, UPI ID, or bank details. Those go directly to Razorpay. Coil's servers never receive them.

3. What we do not do

We do not sell your data, and we do not share it for anyone else's marketing.
We do not run advertising trackers or third-party analytics on the app.
We do not use your watchlist or your trading figures to train anything, and we do not publish or aggregate them.

4. Cookies

One cookie: your login session. It is strictly necessary for the service to work and there is no advertising or tracking cookie to opt out of.

5. Who else processes your data

Processor	What they get	Why
Razorpay	Email, subscription and payment records	To take payment and manage subscriptions
Hetzner Online GmbH	Everything stored, as our hosting provider	To run the servers
Our email provider	Your email address and message content	Password resets, receipts, service notices

6. Where your data is stored

Coil's servers are located in Germany, operated by Hetzner. If you are in India, your personal data is therefore stored and processed outside India. We tell you this plainly because you are entitled to know where your data lives before you decide to hand it over.

7. How long we keep it

Account data: while your account exists, and for up to 30 days after you delete it, so an accidental deletion can be undone.
Payment and subscription records: retained for as long as Indian tax and accounting law requires, currently up to 8 years. We cannot delete these on request, because we are required to keep them.
Server logs: 90 days.

8. Security

Passwords are stored as scrypt hashes. The site is served over HTTPS. Sessions are cookie-based, HttpOnly, and expire. Access to the production server is restricted to the operator.

No service can promise it will never be breached, and we will not pretend otherwise. If a breach affects your personal data, we will tell you and the relevant authority as required by law.

9. Your rights

Under the Digital Personal Data Protection Act, 2023, you may ask us to:

Access the personal data we hold about you.
Correct anything inaccurate or incomplete.
Erase your data, subject to the retention we are legally required to keep.
Withdraw consent — you can close your account at any time.
Nominate someone to exercise these rights if you die or become incapacitated.
Complain to us first, via the grievance contact on the Contact page, and to the Data Protection Board of India if we do not resolve it.

We will respond to any of these within 30 days.

10. Children

Coil is not intended for anyone under 18 and we do not knowingly create accounts for minors.

11. Changes

If this policy changes materially, we will say so in the app and, where the change requires it, ask you to accept the new version before continuing.